Upload File

mainframe [z/os] reverse engineering and exploit development · not going into •cics •tso/e...

  • Home
  • Documents
  • mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and
58
mainframe [z/OS] reverse engineering and exploit development Chad Rikansrud Director, North America RSM Partners

Upload: phungcong

Post on 29-Aug-2019

223 views

Category:

Documents


1 download

Report

TRANSCRIPT

Page 1: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

mainframe [z/OS] reverse engineering and exploit development

Chad RikansrudDirector, North AmericaRSM Partners

Page 2: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

about me

Page 3: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

i used to

Page 4: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and
Page 5: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

but now i

Page 6: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and
Page 7: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

and teach mainframe hacking

Page 8: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and
Page 9: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

so pretty much i

Page 10: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

hack gibsons for a living

Page 11: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

at mainframe security hq

Page 12: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

Mainframe Experts• Pentesting• Assessments• Software• Red Team Augmentation

Page 13: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

the machinearchitecture

Page 14: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

what most people think

Page 15: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and
Page 16: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

what media thinks

Page 17: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and
Page 18: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

what it really is

Page 19: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and
Page 20: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

it’s important

Page 21: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

how important?

•87% of global payments – $8 trillion value•29 billion ATM transactions - $5 billion annually•4 billion passenger flights annually•30 billion total transactions daily•Big numbers – break it down

• $8 Trillion (4 commas) GDP: U.K. + France + India + Brazil

• 919 ATM transactions/second - $158/second

• 7,610 Passenger flights/minute

• 347,222 Total transactions/second – 8.5x > Google

• It’s important

Page 22: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

an analogy

Page 23: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

today is full stack / devops

Page 24: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and
Page 25: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

mainframe style

Page 26: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and
Page 27: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

z/architecture and z/os termsjust the basics

Page 28: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

not going into

• CICS

• TSO/e

• Datasets

• ESM (RACF, TSS, ACF/2)

• see loads of other talks, presenations and content by:• myself• @mainframed767• @ayoul3__

Page 29: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

changing cpu state

problem(subset of instructions)

supervisor(all the instructons)

MODESET -> SVC107 -> LCTL CR03 -> 00C0

Page 30: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

PSW mode and storage key protection

• supervisor vs problem state• PSW – program status word (summary of system flags, settings, EIP)• basically - some vs all CPU instructions

Page 31: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

changing access storage key

non - zero(r/w limited to same key)

00(r/w all the memory)

MODESET -> SVC107 -> LCTL CR03 -> 00C0

Page 32: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

PSW mode and storage key protection

• supervisor vs problem state• PSW – program status word• basically - some vs all CPU instructions

• storage (memory) key• 0-15 – PSW current storage key• PSW key must match (or be 0) storage key

Page 33: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

how it works in z/os

• system startup processes (IPL)• supervisor by design

• SVC / PC (privileged system calls)• SVC – supervisor call• PC – program call

• APF authorized library list• static and dynamic list of libraries (folders)

Page 34: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

authorized program facility list (apf)SYS1.LINKLIB

SYS1.LPALIB

USER.LIBRARY1

PGM.LIBRARY1

PGM.LIBRARY2

if you can edit this list, or update one of these libraries:game over}

Page 35: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

vulnerabiltiessome unique, some familiar

Page 36: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

poorly written SVC or PC

untrusted parameters

source parm address:

0x81FF3C0 KEY 8

read or writew/o using

source or dest keydest return

address:0x8FF3F03 KEY 0

CALL

RETURN

Page 37: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

buffer overflows

return address

jump address

error routine

critical data

input datapgm variable

pgm variable

pgm variable

pgm variable

program read w/o bounds

checking

allocated pgm storage overflowed storage

Page 38: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

intentional backdoors

actionType

secretCode

jumpAddress

saveArea

programparameters check sekrets

good sekret?

console error

yesno

input

Page 39: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

the toolsbad, badder, baddest, really quite good

Page 40: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

DBXlike GDB, but not nearly as fun

Page 41: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and
Page 42: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

debug toolreally just here for the colors

Page 43: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and
Page 44: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

ASMIDFafter hella modifications, can be somewhat useful

Page 45: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and
Page 46: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

TSO/e TESTlearn it for the same reason you learned ‘ed’

Page 47: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and
Page 48: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

z/XDCthe real contender (non-IBM)

Page 49: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and
Page 50: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

reversing and exploitingwonder what this vendor-provided svc does?

Page 51: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

Untrusted parameters and registers

DEMO

Page 52: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

Just a backdoor

DEMO

Page 53: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

putting it all together

DEMO

Page 54: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

further researchwhere to go from here?

Page 55: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

black hat sound bytes

•mainframe is just another computer• it isn’t COBOL• it pretty much runs the financial infrastructure of the planet• oh, and also the airlines, government and healthcare• the security posture could be good, but isn’t yet•most vulnerabilities work here, with some variation• get a pentest, assessment at least annually

Page 56: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

reading - info

• Vulnerability patterns on z/OS(http://events.share.org/Summer2017/Public/SessionDetails.aspx?FromPage=Speakers.aspx&SessionID=3401&nav=true&Role=U%27)

• z/Architecture Principles of Operations(https://www-01.ibm.com/support/docview.wss?uid=isg2b9de5f05a9d57819852571c500428f9a)

• z/XDC Debugger(http://colesoft.com/zxdc/)

http://events.share.org/Summer2017/Public/SessionDetails.aspx?FromPage=Speakers.aspx&SessionID=3401&nav=true&Role=U'
https://www-01.ibm.com/support/docview.wss?uid=isg2b9de5f05a9d57819852571c500428f9a
http://colesoft.com/zxdc/
Page 57: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

thank you

Page 58: mainframe [z/OS] reverse engineering and exploit development · not going into •CICS •TSO/e •Datasets •ESM (RACF, TSS, ACF/2) •see loads of other talks, presenations and

Contact Info:Chad RikansrudDirector, N.A. [email protected]@bigendiansmalls


CICS RACF Security Guide

z/OS Security Server RACF Auditor's Guide ® z/OS Security Server RACF Auditor's Guide

Template is Presenations MS

HTCondor at the RACF

LIST OF POSTER PRESENATIONS - ecis-web.eu · PDF fileLIST OF POSTER PRESENATIONS Poster Session 1 ... PROPERTIES THROUGH THE LANGMUIR-BLODGETT TECHNIQUE ... P63 F. Hooshmand, S. Javadian,

Microsoft Word - Presenations - Slides - 001

Acf catalogue armadi acf

RACF Performance Tuning - RSH Consulting...RSH CONSULTING, INC. RACF SPECIALISTS 617‐969‐9050 RACF Performance Tuning SHARE ‐August 2018

RACF Update

RACF/SDCC Network Operations · RACF/SDCC Network Operations Status Report (August 1, 2019) Alexandr ZAYTSEV [email protected] Aug 1, 2019 RACF/SDCC Network Operations 1

ShaleTech 2011 Presenations

RACF Feb 2005 - CBT Tape · February 2005 39 In this issue 3 Filtering RACF SMF records by userid 7 RACF 101 – understanding RACF terms: part 2 13 Vanguard RACF/Security ... classes

C O U R 5= 23279T racF one ("T racF one Prepa id S of tw are"), into w ireless phone s sold to T racF one ("T racF one /N oki a prepa id phone s"). The propr ietary T racF one Prepa

Forget Free Willy, how about free RACF! - nigelpentland · Forget Free Willy, how about free RACF! first published February 2007 – Xephon RACF Update Many organizations today use

Racf and Ims

RACF Password Security Enhancements … Enhanced RACF... · 2018-07-08 · parallel, and are now viable economically to normal consumers l RACF password cracking tools, including

RACF: an overview

Security Server (RACF) Introduction overview... · CICSPlex IBM RACF. system) LAN File Service/ESA options. IBM

RACF ppt.pptx

20121121 presenations for geo mob

Residential Aged Care Facility (RACF) Train the Trainer ...cec.health.nsw.gov.au/.../0008/609767/RACF-COVID-19... · This resource does not replace the requirements for RACF to meet

RACF Update for z/OS - GSE Homepageconferences.gse.org.uk/attachments/presentations/ERQA0x_144635338… · RACF ® Update for z/OS ® V2.2 Mark Nelson, CISSP®, CSSLP® RACF Design

Teddy Burriss - Onesheet and Top 5 Presenations

Introduction to RACF - RSH Consulting...RSH CONSULTING, INC. RACF SPECIALISTS 617‐969‐9050 Introduction to RACF IBM Systems TechU ‐May 2019

RACF The Essentials For Systems Programmers · PDF fileRSH CONSULTING, INC. RACF SPECIALISTS 617‐969‐9050 RACF ‐The Essentials For Systems Programmers

ICE Installation and Configurationto ACF/VTAM, a standard security system (e.g., RACF, ACF2 or Top Secret), a valid USER ID and PASSWORD, and a non-SNA locally attached console, that

RACF - The Basics (v1.2)

r05 Racf Digital Certificate

Ron frisard’s professional presenations

Synchronizing IBM RACF data using IBM Tivoli Directory ... · 1.8.1 Synchronizing RACF passwords and password phrases ... x Synchronizing IBM RACF data using IBM Tivoli Directory

Security Server (RACF) Introduction

RACF MBS Attendance Items

Welcome introduction. 729 delegates 410 submitted abstracts 59 oral presenations 3 symposia

Introduction to RACF/VM

RACF Feb 2003 - cbttape.org · RACF update 3 Checking dataset access 11 RACF in focus – the Search command 14 Pentland Utilities review: part one – the beginning 30 RACF control